diff --git a/LAPTOP-SETUP.md b/LAPTOP-SETUP.md
index c4b1953..fdee987 100644
--- a/LAPTOP-SETUP.md
+++ b/LAPTOP-SETUP.md
@@ -5,6 +5,35 @@ deliberately **stay** on the Mac Studio.
 
 ---
 
+## Source control
+
+The project is in git, on the church Gitea:
+
+**`http://chronicles-ab.waterschurch.org:3000/christian/recurring-checklist`** (private)
+
+```bash
+git clone http://chronicles-ab.waterschurch.org:3000/christian/recurring-checklist.git
+```
+
+That replaces the tarball below as the way to move the code — but **only the code**. Git
+deliberately carries none of the secrets and none of the live data, so the "Restore the
+secrets" section further down still applies to every new machine, and always will.
+
+Pushing needs a credential for the Gitea. Store it once per machine and the osxkeychain
+helper answers every push after that, unattended:
+
+```bash
+git config --global credential.helper osxkeychain
+```
+
+The first `git push` then asks for the username (`christian`) and a personal access token
+with `write:repository`, generated at *Settings ▸ Applications* in the Gitea web UI. Write
+the remote with the **hostname**, not `10.3.8.90` — the stored credential is keyed to the
+hostname, and a remote written against the bare IP will prompt every time.
+
+The forge is LAN-only. Cloning and pushing need the church network or a VPN into it, the
+same as a web deploy.
+
 ## What to copy
 
 `checklist-app-transfer.tgz` — the whole project minus `node_modules`, build output and
@@ -65,6 +94,18 @@ They are **not** in the transfer bundle on purpose. They are already in
 chmod 600 ~/.appstoreconnect/private_keys/AuthKey_NXR7767SYK.p8
 ```
 
+**The NAS password is a keychain item, not a file.** `build-deploy.sh` and
+`backup-to-drive.sh` used to carry it in plaintext; they now read it from the login keychain,
+so it stays out of the repo and rotating it is one command instead of a history rewrite.
+Store it once per machine — omit the value and `security` prompts for it, so it never reaches
+your shell history:
+
+```bash
+security add-generic-password -U -s checklist-nas -a Christian -w
+```
+
+Both scripts also accept `NAS_PASS` from the environment, for anywhere without a keychain.
+
 Then fix the absolute path inside `keystore.properties`:
 
 ```
diff --git a/server/.gitignore b/server/.gitignore
index 60c3520..a650090 100644
--- a/server/.gitignore
+++ b/server/.gitignore
@@ -1,4 +1,10 @@
 node_modules
 .env
-data/*.json
 *.log
+
+# The live checklists, uploads, docs and backups. These belong on the NAS, not in
+# the repo: the previous rule only caught data/*.json, so an uploaded PDF or a backup
+# would have been committed. Ignore the directory outright — a stale copy restored
+# over production is exactly the accident worth designing out.
+data/
+data-smoke/